eCharge Hardy Barth OS Command Injection Vulnerability in cPH2 and cPP2 Charging Stations

A vulnerability allowing OS command injection has been identified in the eCharge Hardy Barth cPH2 and cPP2 charging stations, specifically in the device firmware version 2.2.0. The issue arises in the '/var/salia/mqtt.php' script, where arbitrary OS commands can be executed with root privileges. This exploitation is achieved by publishing a specially crafted message to a specific MQTT topic.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution with root privileges on the affected charging stations.